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Executive Summary 


The following Executive Summary contains an overview of major points from IAB Europe’s position on 
the proposed Digital Services Act (DSA). IAB Europe (Transparency Register: 43167137250-27) is the 
European-level association for the digital advertising and marketing ecosystem. 


e We have taken good note of the importance attached by the European Commission to ensuring 
a sufficient level of transparency in digital advertising, an attachment that aligns to our own as 
reflected in a range of IAB Europe initiatives and activities intended to increase transparency, 
both Business-to-Business (B2B) and Business-to-Consumer (B2C), and enhance trust. 


e The DSA proposal helpfully confirms the important role that standards and codes of conduct 
can play in enabling industry practice to adapt to changing user expectations with respect to 
transparency. With a proven track record in industry standardisation, we appreciate regulator- 
supported approaches, which can solidify industry’s standards and drive their uptake in the 
market. 


e We believe that a discussion on what new transparency requirements are desired in the DSA 
must be fact-based, and in full understanding of what ex-ante General Data Protection 
Regulation (GDPR) transparency requirements entail. 


e It is important that the future regulation preserve the possibility for users to make informed 
choices based on information disclosures - accessing some online content and services against 
payment and some against a willingness to receive advertisements, with all the user rights and 
company obligations that are already foreseen in EU privacy and data protection law - rather 
than taking choices out of their hands. 


e Empowering the user - in line with the significant transparency and accountability 
requirements under the GDPR - should pave the way to support sustainability of the “open 
web”. Putting into question the lawfulness of targeted advertising or proposing its prohibition, 
or aiming to introduce rules that would be redundant with or contradict the existing EU legal 
framework would be counterproductive. Importantly, it would lead to major unintended 
negative consequences on the EU media and ultimately on internet users themselves. 
Advertising does account for 81% of European media digital revenues, and any decrease in 
these monetisation opportunities would have great repercussions for the free and diverse press 
and media, and in turn, the social and political landscape in Europe. It would effectively deprive 
Europeans from free and open online experience. 


e In this spirit, we look forward to engaging with EU policymakers and legislators on the DSA 
dossier, and to contributing to the elaboration of a regulation that ensures that digital 
advertising can continue to support a pluralistic media and Europeans’ access to the free and 
open internet dependent on ad-supported content. 


For additional information, please contact Greg Mroczkowski, Director, Public Policy at IAB Europe 
(mroczkowski@iabeurope.eu). 
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IAB Europe’s position: Digital Services Act proposal 
Context 


1. IAB Europe (Transparency Register: 43167137250-27) represents the broad digital advertising 
and marketing ecosystem, with 25 national associations whose 5000+ members include 
advertisers, agencies, publishers, and technology companies. We work with over 90 companies 
in our direct membership. 


2. IAB Europe participated in the European Commission’s public consultation on the Digital 
Services Act (DSA)?. In our submission, we recognised the importance of ensuring a strong single 
market to protect citizens and their rights and support the EU’s digital economy. We highlighted 
the importance of advertising as an available revenue stream for European digital media on 
advertising, and its role in providing citizens and businesses with high-value online content and 
services that are free or lower-cost at the point of consumption’. We called on policymakers to 
be cognisant of the significant consumer protections built into the existing regulatory 
framework, notably the EU privacy and data protection framework. 


3. We have taken good note of the importance attached by the Commission in the proposed DSA? 
to ensuring a sufficient level of transparency in digital advertising, an attachment that aligns to 
our own as reflected in a range of IAB Europe initiatives and activities intended to increase 
transparency, both Business-to-Business (B2B) and Business-to-Consumer (B2C), and enhance 
trust. Amongst others, these include the cross-industry open standard to aid GDPR and ePrivacy 
Directive compliance called the Transparency and Consent Framework (TCF), specialised 
technical tools to generate B2B transparency, as well as market-wide approaches such as the 
National IABs Quality Initiatives and Programmatic Codes of Conduct‘. Helpfully, the DSA 
proposal confirms the important role that standards and codes of conduct can play in enabling 
industry practice to adapt to changing user expectations with respect to transparency. It is 
important that the future regulation preserve the possibility for users to make informed choices 
based on information disclosures - accessing some online content and services against 
payment and some against a willingness to receive advertisements, with all the user rights and 
company obligations that are already foreseen in EU privacy and data protection law - rather 
than taking choices out of their hands. 


1 IAB Europe’s comments on the consultation on the Digital Services Act package, 8 September 2020: https://iabeurope.eu/wp- 


content/uploads/2020/09/20200908_IAB-Europe DSA comments.pdf, & IAB Europe’s responses to the consultation on the Digital Services 
Act package, 8 September 2020: https://iabeurope.eu/wp-content/uploads/2020/09/20200908_IAB- 
Europe DSA consultation _responses.pdf. 


2 Advertising accounts for over 81% of European newspaper and magazine digital revenues. For reference, please see: The Economic 
Contribution of Digital Advertising in Europe, IHS Markit, 2017, https://datadrivenadvertising.eu/wp- 
content/uploads/2017/09/DigitalAdvertisingEconomicContribution_FINAL-1.pdf. 

3 Proposal for a Regulation of the European Parliament and of the Council on a Single Market for Digital Services (Digital Services Act) and 
amending Directive 2000/31/EC, COM/2020/825 final. 

4 IAB Europe Reaffirms Its Commitment to Transparency, Amid the Digital Services Act Release, 16 December, https://iabeurope.eu/all- 
news/iab-europe-reaffirms-its-commitment-to-transparency-amid-the-digital-services-act-release/. 
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4. 


There is strong evidence that EU citizens value the opportunity to decide which services they 
pay for with money and which they access in exchange for a willingness to receive advertising. 
More than two-thirds of Europeans (68%) have never paid for any of the online content or 
services that they use. When asked how their internet use would change if required to pay, 88% 
said that they would significantly reduce the amount of time that they spend online. In contrast, 
69% said they were willing for their browsing data to be used in advertising, in order to access 
free content’. The latest study confirms that given the choice, an overwhelming majority of 
Europeans (75%) prefer the current commercial model for the internet, which is funded largely 
by targeted advertising, over a scenario where sites and apps fund themselves through 
subscriptions®. It is important that the future DSA not result in a fragmented internet that is only 
partially accessible to citizens with limited capacity to pay subscriptions. 


IAB Europe supports an “open web” in which advertising provided by a wide variety of market 
participants (advertisers, agencies, technology providers, content and services creators) 
operating in a competitive market can help fund user access to online content and services. A 
DSA regulation that takes good account of what is already laid down in existing law and 
complements the current transparency requirements in ways that further empower consumers 
to make informed choices, will enable this open web to continue to flourish. 


We look forward to engaging with EU policymakers and legislators on the DSA dossier, and to 
contributing to the elaboration of a regulation that ensures that digital advertising can continue 
to support a pluralistic media and Europeans’ access to the free and open internet dependent 
on ad-supported content. 


Liability regime 


Ts 


8. 


IAB Europe believes that the liability regime enshrined in the existing eCommerce Directive 
(ECD) remains relevant’. We welcome maintaining the elementary logic of the ECD in the 
proposed DSA, whereby pursuant to Art 1(5) (a) and the related Rec. 16 & 18 of the DSA, all digital 
advertising ecosystem players caught by the new regulation would continue to benefit from the 
‘safe harbour’ protection from liability provided in the existing law, unless exceptions apply. 


Advertising is generally sent on behalf of a buyer. Most of the partners in the digital advertising 
supply chain will not usually be involved in transmitting ad creatives, as it is the buyer’s ad 
server that normally transmits advertisements to the publisher. The advertiser is therefore 
generally the party on whose behalf an advertisement is made. The paradigm reflects the reality 
of the market, whereby it is the advertiser that is knowledgeable about the product or service 
advertised for, thus being in a position to take decisions about contents of advertising and its 


5 GfK, 


Europe Online: An Experience Driven by Advertising, 2017, https://datadrivenadvertising.eu/wp- 


content/uploads/2017/09/EuropeOnline_FINAL.pdf. 


6 IAB Europe, What Would an Internet Without Targeted Ads Look Like?, April 2021, https://iabeurope.eu/wp-content/uploads/2021/04/IAB- 
Europe_What-Would-an-Internet-Without-Targeted-Ads-Look-Like_April-2021.pdf. 


T Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, 
in particular electronic commerce, in the Internal Market (‘Directive on electronic commerce’), OJ L 178, 17.7.2000. 


IAB Europe 
Rond-Point Robert 
Schumanplein 11 
1040 Brussels 


— 
-> D Belgium 
id e iabeurope.eu 


purpose, as well as other determinations regarding the media buying, for instance, the method 
of trading and desired target audience. 
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9. Accordingly, digital advertising players caching ‘advertisement’ would not be liable for such 
content as long as they meet respective cumulative conditions. This requires, among others, 
that a digital advertising player does not modify the information that it transmits. 


10. Similarly, players hosting ‘advertisement’ would not be liable for such content on condition that 
it does not have actual knowledge of illegal activity or illegal content and upon obtaining such 
knowledge acts expeditiously to remove or disable access to the illegal content. 


11. IAB Europe takes this opportunity to remind the industry players about the relevance of 
organising their digital advertising operations and partnerships with business partners and 
their technology infrastructure in a diligent manner. Comprehensive understanding of media 
buying, and ad transactioning will aid compliance with the EU liability regime. 


Definition of advertising 


12. Article 2(n) defines an ‘advertisement’ as ‘information designed to promote the message of a 
legal or natural person, irrespective of whether to achieve commercial or non-commercial 
purposes’. Underlying aspiration to provide for transparency around all advertising can be 
understood, but it would be advisable to distinguish measures targeted at issues associated 
with political advertising, to which end one should look at the European Commission’s 
European Democracy Action Plan (EDAP)? and existing instruments such as the EU Code of 
Practice (CoP) on Disinformation®. Treating all forms of advertising using a ‘one-size fits all 
approach’ unfairly puts commercial advertising in the same category as political advertising. It 
could also unwittingly undermine the work of national advertising self-regulatory organisations 
(SROs) across Europe which striving to ensure that content of primarily commercial advertising 
is legal, decent, honest and truthful”. 


13. While all data-driven digital advertising is subject to the EU privacy and data protection 
framework, it is important to understand that commercial advertising and political advertising 
is treated differently. The latter appears to be distinct in its nature from other types of non- 
commercial advertising. Importantly, rules pertaining to political advertising are carefully 
assessed in light of the fundamental rights, such as the right to freedom of expression 
guaranteed by Article 10 of the European Convention on Human Rights. 


8 Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the 
Committee of the Regions - European Democracy Action Plan, COM(2020) 790 final. 

? The Code of Practice on Disinformation, unveiled in September 2018, addresses the spread of online disinformation. This is the first time 
worldwide that industry has committed, on a voluntary basis, to self-regulatory standards to fight disinformation. It aims at achieving the 
objectives set out by the Commission's Communication presented in April 2018 by setting a wide range of commitments, from transparency 
in political advertising to the closure of fake accounts and demonetization of purveyors of disinformation. The Code includes an annex 
identifying best practices that signatories will apply to implement the Code's commitments. 


1 European Advertising Standards Alliance (EASA) represents and coordinates the advertising self-regulatory systems across Europe. 
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14. As far as the content of advertising is concerned, commercial advertising is additionally subject 


15. 


16. 


17. 


to strong national self-regulatory codes” that are underpinned by statutory regulation such as 
the Misleading and Comparative Advertising and Unfair Commercial Practices Directives. This 
is different to political advertising, which may or may not be regulated depending on the EU 
Member State, and where stakeholders have undertaken efforts to introduce relevant measures 
under the aforementioned CoP. 


Questions arise as to consequences of a blanket approach of the proposed DSA definition of 
‘advertisement’ equating commercial with non-commercial purposes of the advertiser. To 
reiterate, EDAP does already signals aspiration to provide for a regime for political advertising, 
as well as the so-called issue-based advertising, which is typically construed as a subset of 
political advertising yet to-date has not been delineated with a coherent and broadly accepted 
definition. 


The challenge with defining the latter whereby certain ‘issues’ are discussed in the context of 
elections are a reminder of the fact that many of our public discussions can be viewed as 
politicised. Any future definition of ‘issue-based advertising’ must clearly exclude commercial 
advertising and business-oriented activity of brands that may engage with their prospective 
clientele, and even take views on certain societal issues. The proposed definition of ‘advertising’ 
does exactly the opposite, creating legal uncertainty. 


Therefore, we recommend that this definition be refined to clearly demarcate the distinction 
between commercial advertising and political or non-commercial advertising. This should be 
done in recognition of developments related to political advertising, where tailored approaches 
are underway further to unveiling of the EDAP and investment in existing instruments such as 
the CoP. 


User empowerment and alignment with existing regulatory frameworks 


18. 


19. 


The rules laid down in DSA proposal ‘complement but do not amend existing rules on consent 
and the right to object to processing of personal data™. However, the proposal is prefaced by a 
reference to concerns about the ‘lack of user empowerment and lack of meaningful oversight 
and enforcement’. Rec. 52, in particular, stresses possible negative associated risks. 


The above appears to suggest that while the DSA proposal does not seek to amend or overlap 
with existing rules on processing of personal data, it nevertheless considers those rules as 
insufficient to empower users and prevent negative outcomes in terms of protecting their 
fundamental rights. We disagree with this premise. The GDPR has justifiably (and at no small 
compliance cost to businesses) contributed to creating unprecedented levels of transparency 


1 Self-regulator codes on content of advertising such as ARPP Recommendations are the rules of ethics applicable to advertising in France 
are designed by the local ad ecosystem in consultation with stakeholders. This makes sure they reflect the relevant cultural, business, legal 
and economic contexts. Codes are updated on a regular basis to make sure that ad standards respond to any new developments in ways and 
means of advertising. 


12 DSA proposal, Explanatory Memorandum, p. 5. 


13 DSA proposal, Explanatory Memorandum, p. 9. 
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and user control in the digital advertising sector. Where there are failures to deliver on 
transparency and user empowerment across the EU, these are not due to insufficiently 
prohibitive regulation. Rather, they are the result of divergent interpretations and inconsistent 
enforcement by regulators of the existing rules. 


ope 


20. It is fundamental to appreciate that in cases when illicit actors game the system it is indeed to 
the disadvantage of all concerned - consumers, market participants and the sector in its 
entirety. It is the whole industry - advertisers and advertising agencies on the buy side, news 
publishers and other ad-funded sites and online services on the sell side, and technology 
providers serving both sides - that must be considered as collateral damage of intentional 
misbehaviour (that should be sanctioned) and not as systematic contributors to malpractice. 
This is why the industry integrates certifications and audits into its programmes and best 
practice, which in turns allows for investment of well-meaning players that intend to comply 
with relevant policies or specifications set forth. As an example, both vendors and Consent 
Management Platforms (CMP) leveraging the industry GDPR standard, the Transparency and 
Consent Framework (TCF), are publicly listed’* and a tailored CMP Compliance Programme is 
deployed to facilitate adherence to policies of the standard. 


21. We would also like to contend that all six legal grounds are equal, and no single legal ground 
enjoys an elevated status, whereas a company’s choice of the most appropriate legal basis for 
processing of personal data cannot and should not be ruled out a priori. Instead, it depends 
instead on an assessment of the specific situation at hand, possibly supplemented by clear 
guidance that does not disproportionately restrict digital businesses and is applicable across 
the EU. This is evident upon review of the relevant GDPR’s provisions, including Art. 6(1)(f) GDPR 
and accompanying recitals, such as Rec. 39, 40 and 47 GDPR, as well as highlighted in some 
national Data Protection Authorities (DPA) guidelines’®. Whereas Rec. 52 DSA suggests a ‘need 
to obtain [the] consent of the data subject prior to the processing of personal data for targeted 
advertising’ which prime facie is merely an interpretation of the GDPR, that is normally within 
the remit of the DPAs, and the judiciary. Given the difference of wording between the 
aforementioned Rec. 52 DSA and the one used on page 5 of the DSA Explanatory Memorandum, 
harmonisation of the two reflecting the actual legislative reality should be sought. 


22. IAB Europe supports effective enforcement of the existing law. It is necessary to ensure that 
non-compliance by a minority of rogue actors is adequately sanctioned, to avoid damage to the 
clear added value of the strict compliance commitments undertaken by the rest of the industry 
and undermine user trust and confidence. Industry compliance standards such as the TCF" - 
which enables and empowers users to choose how and by whom their personal data is allowed 
to be used to provide relevant advertising and content - can be a valuable tool contributing to 


14 TCF Global Vendors List is available here: https://iabeurope.eu/vendor-list-tcf-v2-0, whereas a list of all CMPs that passed compliance check 
can be found here: https://iabeurope.eu/cmp-list. 
15 


For instance, DPC Guidance Note: Legal Basis for Processing Personal Data, December 2019, p. 2, available at: 
https://www.dataprotection.ie/sites/default/files/uploads/2019-12/Guidance%200n%20Legal%20Bases_Decl19_1.pdf. 

16 The Transparency & Consent Framework (TCF) transparency mechanisms empower users to make informed choices regarding the 
processing of their personal data as well as identities of companies that process the data in connection with the delivery of digital advertising 
and measurement, while its due diligence record keeping requirements contribute to accountability of the parties involved in the ad 
placement process. More information is available at: www.iabeurope.eu/tcf. 


IAB Europe 
Rond-Point Robert 
Schumanplein 11 
1040 Brussels 


ope 


— 
-> D Belgium 
id ® iabeurope.eu 


efficacy of said enforcement. This is thanks to the standardised transparency and 
accountability it enables and the audit trail it creates, by capacitating data controllers to keep 
a digital record of what user permissions were granted and whether those permissions were 
respected. The digital record can be audited by the regulators, by consumers, by publishers, or 
by commercial partners implementing the standard. 


Online platforms 


23. 


24. 


25. 


Article 2(h) defines ‘online platform’ as a ‘provider of a hosting service which, at the request of a 
recipient of the service, stores and disseminates to the public information’. Furthermore, Rec. 13 
explicitly suggests that ‘social networks’ and ‘online marketplaces’ could fall under the scope of 
such definition. Conversely, it is also suggested that ‘the comments section in an online 
newspaper’ would not be regarded as one. 


As noted in the Commission’s DSA Impact Assessment”, in the context of the digital advertising 
ecosystem”? one recognises the vital role of ‘publishers’, understood to be a ‘website or 
application that has a revenue stream through displaying adverts when visited by a user’. There 
is no immediate discrimination on the type of a digital property that can be monetised through 
advertising, which is amongst others due to the fact that advertisers may be interested in 
various types of audiences consuming a variety of content and services, and underlying 
advertising technology infrastructure can in principle support any type of digital property too. 


Considering the variety of channels and digital properties that the DSA rules on digital 
advertising could apply to and the proposed board definition of ‘advertising’, it would be 
desirable to obtain further clarification on the framing of the ‘online platform’ concept. 


Transparency in digital advertising 


26. 


27. 


IAB Europe recognises the European Commission’s interest in ensuring a sufficient level of 
transparency in digital advertising, including, in particular, through the provisions laid down in 
Art. 24 DSA. 


IAB Europe strongly supports transparency and can reaffirm the industry’s commitment to 
maintaining transparency and quality across the digital advertising and marketing ecosystem, 
for all forms of trading. The Transparency & Consent Framework (TCF) is but one example of a 
standard which contributes to these objectives, by operationalising the already significant 
transparency and accountability requirements under the GDPR. Beyond this critical compliance 
tool to offers B2C transparency to users but also aids the B2B transparency between the parties 
interacting with each other in the digital ads ecosystem, there exists a variety of other resources 


nt European Commission's DSA Impact Assessment, Annex 12: Online advertising, 1.2. Programmatic Advertising, p. 197. 


18 There are many different digital advertising models, including but not limited to: ad servers, ad exchanges, SSPs, DSPs, DMPs, ad networks, 
attribution vendors, market research companies, data companies, affiliate marketing companies and cross device vendors. Each digital 
advertising company has its own unique characteristics. That said, in all instances the ecosystem as such relies on the interplay of a variety of 
market participants, from the buy and sell side, from technology and creativity. The buy-side is commonly understood as comprising 
advertisers buying media, whereas the sell-side comprises publishers offering advertising inventory. 


IAB Europe 
Rond-Point Robert 
Schumanplein 11 
1040 Brussels 


— 
-> dD Belgium 
id e iabeurope.eu 


and technical tools that are being honed and iterated to analyse the supply chain and optimise 
it, effectively generating B2B transparency - examples include IAB Europe’s Supply Chain 
Transparency Guide”, IAB Tech Lab’s ads.txt - Authorised Digitals Sellers”, sellers.json and 
OpenRTB Supply Chain object”. In addition, national standards are being developed in Europe, 
such as market-wide Programmatic Codes of Conduct. Finally, one can observe emergence of 
several market-wide programmes, driven by European National IABs”, that are designed to 
increase transparency and trust in how digital advertising is bought and sold, built on more 
specific pillars such as brand safety, fraud prevention, viewability, user experience, and most 
recently, addressing the privacy concerns within the digital supply chain. 


ope 


28. More generally, IAB Europe believes that a discussion on what new transparency requirements 
are desired in the DSA must be fact-based, and in full understanding of what ex-ante GDPR 
transparency requirements entail, many of which can be met with the support of the 
aforementioned TCF, which standardises how websites and other digital properties make the 
information disclosures required by the GDPR, how the sites collect and log users’ choices, how 
they communicate those choices to their third-party technology partners, and what those 
partners may and may not do as a consequence. It delivers this functionality using a 
combination of software and a digital signal that is transmitted from each website to a defined 
set of technology partners with whom the website works. The signal captures which data 
processing purposes and data controllers the user has authorised, if any, and requires those 
receiving the signal to honour it in accordance with clearly defined rules. Art. 13 GDPR stipulates 
‘Information to be provided where personal data are collected from the data subject’, whereas 
Art. 14 GDPR ‘Information to be provided where personal data have not been obtained from the 
data subject’. What is of relevance in the digital advertising context is that, for instance, the 
GDPR stipulates that the data subject must be informed at least of the identity of the controller 
and the purposes for which the personal data are to be processed.” When consent is used as a 
legal basis, for it to be valid, consent requests and information must: 


(1) be provided prominently and separately from other information, such as terms and 
conditions;”° 
(2) be presented in plain language that is easy to understand;”° 


19 JAB Europe Supply Chain Transparency Guide, updated in March 2021, https://iabeurope.eu/knowledge-hub/iab-europe-supply-chain- 
transparency-guide-updated-in-march-2021/. 


20 https://iabtechlab.com/ads-txt/. 


al https://iabtechlab.com/sellers-json/. 


22 The DACH (German speaking markets: Germany (D), Austria (A), and Switzerland (CH)), and Polish markets put in place Programmatic Codes 
of Conduct, which include commitments with precise rules for all market participants. 


23 IAB Europe Navigator: Quality Initiatives (July 2020) demonstrates the vast amount of work being undertaken in Europe and beyond to build 
and ensure a sustainable future for digital advertising and marketing. There are both similarities and differences across all of these initiatives. 
It includes a summary of the work being undertaken in national markets such as quality certification schemes, guidelines and best practice 
guides. 


24 Rec. 42 GDPR. 
25 Art. 7(2) GDPR; Rec. 42 GDPR. 
26 Ibid. 
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29. 


30. 


(3) describe the nature of the personal data processed (e.g. random identifiers, browsing 
data);?’ 

(4) describe the purpose of - or reason for - the processing; 

(5) explain the consequences (if any) of the processing; 

(6) list the controller or various controllers that will be relying on the consent to process 
personal data - individually by name;*° 

(7) inform users of their right to withdraw consent, as well as how to do so; and 

(8) educate users about the consequences of not consenting to the processing, for instance, a 
reduced user experience or being prevented from using a site or service.** 


Similarly - taking note of the broader discussion about targeted advertising and calls for 
banning the business model such as on the basis of the European Parliament’s Committee on 
Legal Affairs (JURI) non-legislative report on DSA® - it must be remembered that the GDPR 
unambiguously calls out pseudonymous identifiers (Rec. 26 GDPR), online identifiers, such as 
cookies, and device identifiers, as examples of personal data (Art. 4(1) GDPR, Rec. 30 GDPR), 
stipulates rules on profiling and provides enhanced rights to users where profiling takes place 
(Art. 4(4) GDPR, Art. 22 GDPR, Rec. 72 GDPR), including where user behaviour is tracked online 
(Rec. 24 GDPR). Demonstrably illegal behaviour under the existing law - for instance, when data 
is used for advertising purposes despite having been collected for non-advertising purposes, or 
processing of special categories of personal data without a specific legal basis required - must 
be condemned and this is where one benefits from enforcement tools envisaged by the 
lawmaker in the GDPR. Against that background, we do believe that transnational Codes of 
Conduct have the potential to bring significant benefits to data controllers and legal certainty 
to data subjects, and we would like to insist on the fact that this approach to compliance be 
prioritised. For instance, a tool such as the TCF is a prime example of a situation where 
recognition as a transnational GDPR Code of Conduct would bring significant compliance 
benefits to both consumers and the industry. The resulting increased market coverage would 
greatly improve overall compliance levels in the digital advertising industry, contribute to a 
streamlined user experience, as well as provide an adequate EU- wide tool enabling national 
authorities to assess compliance across this inherently transnational sector. 


Conversely, incidence of non-compliance must not however be exploited to portray targeted 
advertising as a malpractice that exploits users’ ignorance and naiveté while offering them little 
in return fails to take account of the reality of how the business model benefits the media and 
users. 


27 article 29 Working Party Opinion 187 on the definition of consent, p. 19, available at 


http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2011/wp187_en.pdf. 
28 Rec. 42 GDPR. 


29 article 29 Working Party Opinion 187 on the definition of consent, p. 19, available at 
http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2011/wp187_en.pdf. 


30 Rec, 42 GDPR. 
31 Art. 7(3) GDPR. 


32 


Article 29 Working Party Opinion 187 on the definition of consent, p. 19, available at 
http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2011/wp187_en.pdf. 


a3 European Parliament resolution of 20 October 2020 with recommendations to the Commission on a Digital Services Act: adapting 
commercial and civil law rules for commercial entities operating online (2020/2019(INL)). 
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31. Evidence about the value of digital advertising, including the targeted advertising, is not 
anecdotal. Local, generalist press, whose investigative reporting empowers citizens to hold 
power to account in a democratic society, cannot be funded with contextual ads alone, since 
such content is seldom suited to contextual targeting. By contrast, behavioural targeting is 
more effective - it creates greater utility for consumers likely to see more relevant and less 
repetitive ads, and clear appeal for advertisers with over 5 times more effective click-through 
rates™. If the most efficient - hence valuable - form of digital advertising were to be prohibited, 
publishers and content creators would have to increase the number of less relevant ads served 
to each consumer to achieve the same revenue. Worryingly, the restrictions would lead to fewer 
available services, less unpaid quality content and services, and more paywalls. Polarisation 
would be rampant in our democratic society if information were only available to those who are 
affluent enough to pay for access to it, with the inevitable decrease of the media pluralism 
making European citizens more dependent on state-controlled media. 


32. More broadly, digital advertising benefits European small-medium sized enterprises (SMEs) - 
be it companies that advertise their products or the (hundreds of) thousands of app developers 
or European online platforms. SMEs will also be increasingly reliant on targeted advertising to 
reach their target audiences at an affordable price. Playing a pivotal role in the EU economy, 
such businesses are required to meet raising expectations of their customers, while keeping 
costs down - this is why ability to target and measure, as well as optimise advertising 
campaigns that primarily reach right audiences allows SMEs to run their marketing operations 
in a cost-efficient manner. As such, digital advertising supports the Commission’s efforts to 
champion SMEs and stimulate business recovery and growth. These segments of the economy 
will also be critical for Europe’s post-Covid-19 recovery and access to as many digital tools as 
possible will be key to their success. With many European economies currently navigating the 
fallout of the pandemic, and the majority of SMEs beings concerned about the future of their 
businesses, research shows that as many as half of all SME advertisers can consider digital 
advertising to be more important than ever to support their business during this time of crisis”. 


33. As far as specific requirements of Art. 24 DSA are concerned (‘(a) that the information displayed 
is an advertisement; (b) the natural or legal person on whose behalf the advertisement is 
displayed; (c) meaningful information about the main parameters used to determine the recipient 
to whom the advertisement is displayed’), we recognise that in particular elements (a) and (b) 
build on the existing requirements of Art. 6 ECD. Currently, all commercial communications - 
including advertising - must be clearly identifiable as such, along with the natural or legal 
person on whose behalf the commercial communication is made and various other details such 
as the conditions for any promotional offers like discounts. The reference to ‘each specific’ 
advertisement suggests that the transparency requirements would apply on an ad-by-ad basis 
which would constitute a significant operational change for the digital advertising ecosystem. 


34 IHS Markit, The Economic Value of Behavioural Targeting in Digital Advertising, 2017, https://datadrivenadvertising.eu/wp- 


content/uploads/2017/09/BehaviouralTargeting FINAL.pdf. 
35 IAB UK, Digital advertising crucial to SMEs’ recovery, 11 June 2020, https://www.iabuk.com/news-article/digital-advertising-crucial-smes- 
recovery. 
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34. 


In light of the above, we would suggest that there is an opportunity to leverage an existing 
industry standard such as the TCF, which currently provides for ex-ante transparency, for the 
purposes of meeting the proposed ex-post transparency requirement. To that end, the 
‘meaningful information’ criterion could be specified per the GDPR transparency requirements, 
which already serve to meaningfully inform the user about the reasons for which their data is 
processed - which correspond to the nature and specificity of the personalisation - without 
unnecessarily imposing presicriptive measures that could lead to the disclosure of business- 
critical intelligence and trade secrets and risk stifling innovation in the sector. Instead, existing 
and well-functioning standardisation efforts could be used to drive the market participation 
and to ensure continued uptake of relevant tools, which is how one could understand the EU 
policymaker contemplating boosted involvement of the digital ads ecosystem through a code 
of conduct for online advertising (Art. 36). 


Codes of Conduct 


35. 


36. 


37. 


38. 


With a proven track record in industry standardisation, IAB Europe appreciates regulator- 
supported approaches, including codes of conduct (CoC) instruments. Regulators’ 
endorsement can solidify industry’s standards and drive their uptake in the market. 


With the above in mind, IAB Europe welcomes the Commission’s interest in supporting and 
promoting the ‘development and implementation of voluntary industry standards set by relevant 
European and international standardisation bodies’, as set forth in Art. 34 and related Rec. 66, 
the ensuing Art. 35, and finally Art. 36 and related Rec. 67-70 that propose tailored codes of 
conduct for online advertising. As the European-level association for the digital marketing and 
advertising ecosystem, IAB Europe’s mission includes promotion of industry collaboration to 
deliver frameworks, standards and industry programmes that enable business to thrive in the 
European market. 


IAB Europe contends the view of the Commission, stipulated amongst others, in Rec. 70 that the 
‘provision of online advertising generally involves several actors, including intermediary services 
that connect publishers of advertising with advertisers’. Art. 36 envisages CoC(s) remit to 
comprise the transmission of information held by providers of online advertising intermediaries 
‘to recipients of the service with regard to requirements set in points (b) and (c) of Article 24’, as 
well as ‘to the repositories pursuant to Article 30’. While devising any viable approaches would 
require detailed assessment of final legal provisions, it can be expected that interoperability 
will be sought-after to ensure successful collaboration between various actors in the complex 
digital ads ecosystem. 


Art. 36 indicates expeditious roll-out of CoC instrument(s), with ‘development within one year 
following the date of application of the DSA and their application no later than six months after 
that date’. However, lawmakers should bear in mind experience and observations gained from 
implementation of other legal instruments, including - what is of relevance from the 
perspective of the digital advertising ecosystem - developments of the CoCs under the Directive 
95/46/EC and currently GDPR. Experience with the GDPR has shown the importance of a 
reasonable transition period of 18-36 months to afford businesses enough time to assess the 
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new rules and make the necessary changes to their privacy policies, products and services, as 
well as for industry standards to be adapted to enable compliant processing. The EU-level CoC 
approval is a manifestly complex and often protracted process under the GDPR. We would 


recommend taking the aforementioned into account when suggesting such an ambitious 
timeline for elaboration and implementation of standards under the DSA. 
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